Solved BSOD after booting into 7

[Bedore]

Working on a Dell Inspiron N7110 running Windows 7 Home Premium SP1. The computer will boot into Windows fine, but after about 30 seconds to a minute it will blue screen and reboot. I have re-seated the memory and run memtest, as well as Dell's built in diagnostics and everything passed. Safe mode will work. I believe this may be a driver issue or loading something during startup that is causing the BSOD. I have attached the dmp files in hopes that somebody here can help me figure the problem out in hopes that I won't need to re-install a fresh copy of 7.

Thanks in advance.

 

[koolkat77]

Security App

mfeapfk.sys                 Tue Oct 11 02:41:23 2011 (4E935873)
mfeavfk.sys                 Tue Oct 11 02:41:51 2011 (4E93588F)
mfefirek.sys                Tue Oct 11 02:44:46 2011 (4E93593E)
mfehidk.sys                 Tue Oct 11 02:40:22 2011 (4E935836)
mfenlfk.sys                 Tue Oct 11 02:41:04 2011 (4E935860)
mfewfpk.sys                 Tue Oct 11 02:40:40 2011 (4E935848)

Crashes indicate McAfee being a possible cause. Remove McAfee and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software. Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.

Microsoft Security Essentials, Free antivirus for windows and Malwarebytes Anti-Malware Free

   Information

• :warn: Do not start the free trial of MalwareBytes, unselect that option when prompted.
  
  
  
  
  
• :tip: Update and make full scans with both separately.

Virus check
Scan your system with the following:

Kaspersky TDSSKiller - How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)

ESET online scanner - One-time virus scanner free with ESET online scanner

Hard Drive/Storage

Post disk summary using CrystalDiskInfo software: CrystalDiskInfo Standard Edition

• :info: For how to upload a screenshot or file, read here

Basic checks:
Please run these tests and report back the results

1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
2. Disk check for errors on the hard drive - How to Run Disk Check in Windows 7
3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure

BSOD BUGCHECK SUMMARY

[I]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {fffff8801f200000, 1, fffffa80082e02e6, 2}


Could not read faulting driver name
Probably caused by : partmgr.sys ( partmgr!PmGlobalDispatch+9f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8801f200000, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffffa80082e02e6, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff800038fc100
GetUlongFromAddress: unable to read from fffff800038fc1c0
 fffff8801f200000 Nonpaged pool

FAULTING_IP: 
+0
fffffa80`082e02e6 f3aa            rep stos byte ptr [rdi]

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  mcshield.exe

CURRENT_IRQL:  0

TRAP_FRAME:  fffff88008986460 -- (.trap 0xfffff88008986460)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000e6543200
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80082e02e6 rsp=fffff880089865f8 rbp=fffffa800bd44658
 r8=00000000f504bc00  r9=0000000000000001 r10=fffff88005743000
r11=0000fffffffff000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
fffffa80`082e02e6 f3aa            rep stos byte ptr [rdi]
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003673f40 to fffff800036cd1c0

STACK_TEXT:  
fffff880`089862f8 fffff800`03673f40 : 00000000`00000050 fffff880`1f200000 00000000`00000001 fffff880`08986460 : nt!KeBugCheckEx
fffff880`08986300 fffff800`036cb2ee : 00000000`00000001 fffff880`1f200000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x43d86
fffff880`08986460 fffffa80`082e02e6 : fffffa80`082e07e4 00000000`00000002 fffffa80`0bd44540 fffffa80`00000001 : nt!KiPageFault+0x16e
fffff880`089865f8 fffffa80`082e07e4 : 00000000`00000002 fffffa80`0bd44540 fffffa80`00000001 fffffa80`0bd44658 : 0xfffffa80`082e02e6
fffff880`08986600 00000000`00000002 : fffffa80`0bd44540 fffffa80`00000001 fffffa80`0bd44658 00000000`00000001 : 0xfffffa80`082e07e4
fffff880`08986608 fffffa80`0bd44540 : fffffa80`00000001 fffffa80`0bd44658 00000000`00000001 fffff800`00000000 : 0x2
fffff880`08986610 fffffa80`00000001 : fffffa80`0bd44658 00000000`00000001 fffff800`00000000 00000000`00000200 : 0xfffffa80`0bd44540
fffff880`08986618 fffffa80`0bd44658 : 00000000`00000001 fffff800`00000000 00000000`00000200 00000000`00000200 : 0xfffffa80`00000001
fffff880`08986620 00000000`00000001 : fffff800`00000000 00000000`00000200 00000000`00000200 fffffa80`0b7d2010 : 0xfffffa80`0bd44658
fffff880`08986628 fffff800`00000000 : 00000000`00000200 00000000`00000200 fffffa80`0b7d2010 00000000`00000400 : 0x1
fffff880`08986630 00000000`00000200 : 00000000`00000200 fffffa80`0b7d2010 00000000`00000400 fffffa80`0bf35010 : 0xfffff800`00000000
fffff880`08986638 00000000`00000200 : fffffa80`0b7d2010 00000000`00000400 fffffa80`0bf35010 fffff880`01859445 : 0x200
fffff880`08986640 fffffa80`0b7d2010 : 00000000`00000400 fffffa80`0bf35010 fffff880`01859445 00000000`00000000 : 0x200
fffff880`08986648 00000000`00000400 : fffffa80`0bf35010 fffff880`01859445 00000000`00000000 00000000`00000000 : 0xfffffa80`0b7d2010
fffff880`08986650 fffffa80`0bf35010 : fffff880`01859445 00000000`00000000 00000000`00000000 00000000`00000001 : 0x400
fffff880`08986658 fffff880`01859445 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`00000400 : 0xfffffa80`0bf35010
fffff880`08986660 fffff880`01859975 : fffffa80`07da5010 fffffa80`06b73050 00000000`00020000 fffff880`00000000 : CLASSPNP!ServiceTransferRequest+0x355
fffff880`08986700 fffff880`00e410af : fffffa80`0b7d2010 fffffa80`0b7d2010 fffffa80`0b7d21b8 fffffa80`0bf46010 : CLASSPNP!ClassReadWrite+0xd5
fffff880`08986750 fffff800`039341b0 : fffffa80`0b7d2200 fffffa80`0bd8fe50 fffffa80`0b97f6e0 00000000`00000000 : partmgr!PmGlobalDispatch+0x9f
fffff880`08986780 fffff800`03933e4d : 00000000`00000000 fffff880`08986860 fffffa80`0b7d2010 fffff800`036c2ddd : nt!RawReadWriteDeviceControl+0xa8
fffff880`089867c0 fffff880`01202bcf : fffffa80`0b7d2200 fffffa80`0b88a390 00000000`00000000 fffffa80`0b7d2010 : nt!RawDispatch+0x7d
fffff880`08986820 fffff880`012016df : fffffa80`0c050de0 00000000`00000001 fffffa80`0c050d00 fffffa80`0b7d2010 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`089868b0 fffff800`039d0eab : 00000000`00000000 fffffa80`0b97f6e0 00000000`00000001 fffffa80`0b7d2010 : fltmgr!FltpDispatch+0xcf
fffff880`08986910 fffff800`039b2753 : fffffa80`0b97f6e0 fffffa80`0b7d2001 fffffa80`0b97f6e0 00000000`00000002 : nt!IopSynchronousServiceTail+0xfb
fffff880`08986980 fffff800`036cc453 : 00000000`00000758 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x631
fffff880`08986a70 00000000`774d137a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`04a8cc88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774d137a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
partmgr!PmGlobalDispatch+9f
fffff880`00e410af 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  12

SYMBOL_NAME:  partmgr!PmGlobalDispatch+9f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: partmgr

IMAGE_NAME:  partmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4f641bc1

FAILURE_BUCKET_ID:  X64_0x50_partmgr!PmGlobalDispatch+9f

BUCKET_ID:  X64_0x50_partmgr!PmGlobalDispatch+9f

Followup: MachineOwner
---------

[/I]

 

[Bedore]

Thanks for the help. I removed McAfee and ran a spyware/malware sweep and that seems to have cured the problem. Thanks again.

 

[koolkat77]

You're welcome.

Post here if they occur again.